Update dependency ai to ^6.0.240

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
ai (source)	^6.0.203 → ^6.0.240

---

Release Notes

vercel/ai (ai)

v6.0.240

Compare Source

Patch Changes

• Updated dependencies [b28367e]
  • @​ai-sdk/gateway@​3.0.162

v6.0.239

Compare Source

Patch Changes

• Updated dependencies [d3d9e0b]
  • @​ai-sdk/gateway@​3.0.161

v6.0.238

Compare Source

Patch Changes

• 9ecdefe: Prevent validated downloads on Node.js from reaching private or internal services through DNS aliases or DNS rebinding by validating and pinning every resolved address at connection time.
• 26d10c0: support overriding model call settings for individual prepareStep invocations
• 7767170: Preserve provider metadata from empty text deltas in streamText.
• Updated dependencies [9ecdefe]
• Updated dependencies [87fb433]
  • @​ai-sdk/provider-utils@​4.0.41
  • @​ai-sdk/gateway@​3.0.160

v6.0.237

Compare Source

Patch Changes

• f6020d7: Avoid synthesizing client tool errors for invalid provider-executed tool calls.
• Updated dependencies [de438f5]
  • @​ai-sdk/gateway@​3.0.159

v6.0.236

Compare Source

v6.0.235

Compare Source

Patch Changes

• Updated dependencies [5d7b986]
  • @​ai-sdk/gateway@​3.0.157

v6.0.234

Compare Source

Patch Changes

• 1efdef8: fix(ai): bound media-type sniffing decode for ID3-prefixed input

  Media-type detection stripped ID3 tags before the ~18-byte prefix cap, decoding the entire base64 attachment (plus a full-size copy) whenever the data began with ID3/SUQz. This turned the intended O(1) sniff into an O(N) decode of the whole attachment. Detection now decodes at most a bounded prefix and skips the ID3 tag within that bound, keeping cost O(1) in input size on all paths (image, audio, and combined).

• 49414cf: Return response piping promises so callers can catch stream read and write errors.

• Updated dependencies [e7d064f]

  • @​ai-sdk/gateway@​3.0.156

v6.0.233

Compare Source

Patch Changes

• fe410e7: fix: detect MP4 audio from its ftyp box during transcription
• af7188c: fix(ai): preserve tool parts when tool call IDs repeat across steps
• Updated dependencies [a09f944]
  • @​ai-sdk/gateway@​3.0.155

v6.0.232

Compare Source

Patch Changes

• 7644a61: Preserve provider options when combining consecutive tool messages.

v6.0.231

Compare Source

Patch Changes

• 926f5a0: Allow UI message chunks to include fields added by newer server versions.
• 4c5a22f: Propagate abort reasons when generation is cancelled during tool execution.
• 842a383: Prevent tools excluded by activeTools from being parsed or executed.
• Updated dependencies [2dd1aab]
• Updated dependencies [e567091]
  • @​ai-sdk/gateway@​3.0.154

v6.0.230

Compare Source

Patch Changes

• 19093fd: fix(ai): call onInputStart before onInputAvailable during non-streaming tool calls
• Updated dependencies [19093fd]
  • @​ai-sdk/provider-utils@​4.0.40
  • @​ai-sdk/gateway@​3.0.153

v6.0.229

Compare Source

Patch Changes

• Updated dependencies [49a3098]
  • @​ai-sdk/gateway@​3.0.152

v6.0.228

Compare Source

Patch Changes

• Updated dependencies [5e624ac]
  • @​ai-sdk/gateway@​3.0.151

v6.0.227

Compare Source

Patch Changes

• 6ace546: Fix chat onFinish handling when overlapping requests clear the active response before a resume stream finishes.

v6.0.226

Compare Source

Patch Changes

• 94219a2: Allow validating assistant UI messages with empty parts so persisted errored responses remain loadable.
• b1be847: Prevent pending tool executions from enqueueing results after a model stream error closes the result stream.
• Updated dependencies [06fb54c]
• Updated dependencies [bc46977]
  • @​ai-sdk/provider-utils@​4.0.39
  • @​ai-sdk/gateway@​3.0.150

v6.0.225

Compare Source

Patch Changes

• Updated dependencies [7c48ed8]
  • @​ai-sdk/gateway@​3.0.149

v6.0.224

Compare Source

Patch Changes

• Updated dependencies [982aa3e]
  • @​ai-sdk/gateway@​3.0.148

v6.0.223

Compare Source

Patch Changes

• Updated dependencies [a452291]
  • @​ai-sdk/gateway@​3.0.147

v6.0.222

Compare Source

Patch Changes

• e1af05f: feat (video): support video (not just image) reference inputs in inputReferences for reference-to-video generation
• Updated dependencies [2bfb16a]
• Updated dependencies [34b5acc]
• Updated dependencies [e1af05f]
• Updated dependencies [1ce0d1c]
  • @​ai-sdk/gateway@​3.0.146
  • @​ai-sdk/provider@​3.0.14
  • @​ai-sdk/provider-utils@​4.0.38

v6.0.221

Compare Source

v6.0.220

Patch Changes

• 158d027: Sort tool results by their tool call order when converting generation output to response messages.
• eb3cdd9: Fix extractJsonMiddleware preserving leading whitespace in the final streamed text suffix when no markdown fence prefix was stripped.
• Updated dependencies [7dea716]
• Updated dependencies [4f7fe37]
• Updated dependencies [0952964]
  • @​ai-sdk/gateway@​3.0.144
  • @​ai-sdk/provider-utils@​4.0.36

v6.0.219

v6.0.218

Patch Changes

• ea1e95b: feat(mcp): add maxRetries option for failed mcp tool calls
• Updated dependencies [ea1e95b]
  • @​ai-sdk/provider-utils@​4.0.35
  • @​ai-sdk/gateway@​3.0.142

v6.0.217

Patch Changes

• fa850e6: feat (video): add first-class frameImages and inputReferences call options for video generation
• Updated dependencies [95bc6fd]
• Updated dependencies [f6b2159]
• Updated dependencies [fa850e6]
  • @​ai-sdk/gateway@​3.0.141
  • @​ai-sdk/provider@​3.0.13
  • @​ai-sdk/provider-utils@​4.0.34

v6.0.216

Patch Changes

• Updated dependencies [f6689df]
• Updated dependencies [13b6a72]
  • @​ai-sdk/gateway@​3.0.140

v6.0.215

Patch Changes

• f66ac32: fix(ai): prune orphaned tool-approval responses in pruneMessages

  When pruning a specific tool by name (toolCalls: [{ type, tools: [...] }]), pruneMessages left the tool's tool-approval-response in place while removing its tool-approval-request and tool-call. The tool name of an approval response was resolved per-message, but approval responses live in a separate tool message from their approval request, so the name could never be resolved and the response was always kept. Tool name resolution is now done across all messages, so approval requests and responses are pruned together.

v6.0.214

Patch Changes

• Updated dependencies [b30e43a]
  • @​ai-sdk/provider-utils@​4.0.33
  • @​ai-sdk/gateway@​3.0.139

v6.0.213

Patch Changes

• f19334d: feat (video): add first-class generateAudio call option
• Updated dependencies [fb601aa]
• Updated dependencies [f19334d]
  • @​ai-sdk/gateway@​3.0.138
  • @​ai-sdk/provider@​3.0.12
  • @​ai-sdk/provider-utils@​4.0.32

v6.0.212

Patch Changes

• Updated dependencies [932c680]
  • @​ai-sdk/gateway@​3.0.137

v6.0.211

Patch Changes

• Updated dependencies [6ce12b0]
• Updated dependencies [4cb4414]
  • @​ai-sdk/gateway@​3.0.136

v6.0.210

Patch Changes

• 1b40ac7: Publish all packages under the @ai-v6 dist tag.
• Updated dependencies [1b40ac7]
  • @​ai-sdk/gateway@​3.0.135
  • @​ai-sdk/provider-utils@​4.0.31
  • @​ai-sdk/provider@​3.0.11

v6.0.209

Compare Source

v6.0.208

Compare Source

v6.0.207

Compare Source

Patch Changes

• 779f5cd: fix(provider-utils): cancel response body on download rejection to prevent socket leak

  When a download was rejected early — because the Content-Length header exceeded the size limit, the response status was not ok, or a redirect resolved to a blocked URL — the fetch response body was left unconsumed and uncancelled. With WHATWG Fetch/undici this leaves the underlying TCP socket open instead of returning it to the connection pool, allowing an attacker-controlled origin to exhaust file descriptors and cause a denial of service. The body is now cancelled on all early-rejection paths in readResponseWithSizeLimit, download, and downloadBlob, and fetchWithValidatedRedirects cancels each redirect hop's body before following or rejecting the next hop.

• Updated dependencies [5bfde36]

• Updated dependencies [779f5cd]

  • @​ai-sdk/gateway@​3.0.133
  • @​ai-sdk/provider-utils@​4.0.30

v6.0.206

Compare Source

Patch Changes

• Updated dependencies [e962dda]
  • @​ai-sdk/gateway@​3.0.132

v6.0.205

Compare Source

Patch Changes

• Updated dependencies [6160ced]
• Updated dependencies [c9b8abd]
  • @​ai-sdk/gateway@​3.0.131

v6.0.204

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.